Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker is deleting Open Source organisations - what you need to know

blog.alexellis.io

Post reply on HN
Print view View original

691–700 of 764 posts

Re: Docker is deleting Open Source organisations - what you need to know

#691

Post by _cenw »

zamnos wrote: post #485
cshimmin wrote: post #389

Earlier quoted context omitted.

I mean, it's not a terrible convention. On the website they have a badge ("docker official image"), but devs aren't usually looking at the website, they're looking at their Dockerfile in vim or whatever. This is a straightforward way to communicate that semantically through namespacing. Still, shame on docker for the rug-pull.

It's better than none, but explicit over implicit. If it were namespaced like PULL docker.org/offical/alpine:latest that would be better, imo.

They are also available at docker.io/library/alpine and equivalent, and I'd advise anyone to start using this format as more distros might break the default registry[1].

[1]: https://man.archlinux.org/man/containers-registries.conf.5.e...

Re: Docker is deleting Open Source organisations - what you need to know

#692

Post by tlavoie »

maxyurk wrote: post #684
fbdab103 wrote: post #669

Earlier quoted context omitted.

I do not know if Nix will be the answer, but I really hope it or a successor drags us to fully explicit and reproducible builds.

for reproducing a build you need at the least the source and the tools to build it which might not be available as well

Yes, but Nix is essentially about getting things built, so those build tools are part of the recipe to make something happen.

I'm still learning Nix myself, but one small example: a small, Haskell-based utility I've written depends on specific versions of one library, due to API changes. That version gets lumped in according to some GHC versions. The whole situation was uncomfortable, in that code I had left working, stopped building some time later when I came back to run with whatever was seeming more current.

Defining a short nix flake solved all of that. That first compile was a slog, since it fetched and built the appropriate GHC and libraries, including whatever transitive dependencies those needed. Once done though, those are cached, and "nix build" just works.

Re: Docker is deleting Open Source organisations - what you need to know

#693

Post by FredPret »

t344344 wrote: post #207
voytec wrote: post #128

Earlier quoted context omitted.

> Docker should have been a neat tool made by one enthusiast, just like curl is. I have nothing but mad respect for Daniel Stenberg. 25 years of development of great software, for which he had been threatened[1] and had ridiculous US travel visa obtaining issues[2]. [1] https://daniel.haxx.se/blog/2021/02/19/i-will-slaughter-you/ [1] https://news.ycombinator.com/item?id=26192025 [2] https://daniel.haxx.se/blog/2020/1…

> ridiculous US travel visa obtaining issues Ridiculous? This is pretty common issue for anyone who travels to US. Visa may be denied for whatever reason and tough luck on appeal. I am EU citizen and had similar experience just for visiting Iran on tourist trip. Do not even ask about guys from India, Pakistan or less fortunate countries. And it got even worse with pandemic. US required vaccination for very long time,…

While it’s true that US visa applications can be difficult, the same is true for any first-world country.

I was born in a third-world country, and ended up getting tourist visas to the EU, US, and Canada. US was by far the easiest - for me anyway.

If you want a large global meeting in a safe country (I would never in my life go to Mexico) there will be visa issues.

Re: Docker is deleting Open Source organisations - what you need to know

#694

Post by GoblinSlayer »

dbingham wrote: post #560
jjav wrote: post #477

Earlier quoted context omitted.

> If those images disappear, we lose the ability to release and that's not acceptable. This shines light on why it is so risky (from both availability and security perspectives) to be dependent on any third party for the build pipeline of a product. I have always insisted that all dependencies must be pulled from a local source even if the ultimate origin is upstream. I am continuously surprised how many groups simpl…

We can't go NIH for everything. If we do that we're back to baremetal in our own datacenters and that's expensive and (comparatively) low velocity. We have to pick and choose our dependencies and take the trade off of risk for velocity. This is the tradeoff we made with the move to cloud. We run our workloads on AWS, GCP or Azure, use DataDog or New Relic for monitoring, use Github or GitLab for repos and pipelines,…

You can prototype without NIH and later go NIH when you have stuff to lose.

Re: Docker is deleting Open Source organisations - what you need to know

#695

Post by jhoelzel »

rustyminnow wrote: post #466
jhoelzel wrote: post #452

Please dont forget that you can cache all these images in your own registry! you will still have to worry about how to get updates, but set up a private registry and deal with this on your on time! As a side node, Rancher desktop is good enough. Docker has repeatedly demonstrated that they just where the first ones and not by any means the best ones.

Any tips to running your own registry? e.g. what registry software/package do you use? I think when I looked into this in the past, I couldn't find anything suitable. A quick search now brings up https://hub.docker.com/_/registry , but considering the content of the article, not sure how I feel about it

this depends on how your setup is!

for instance bigger clouds offer you private registry with your account usually.

Then there is the github container registry: https://github.blog/2020-09-01-introducing-github-container-...

one integrated for self hosted gitlab: https://docs.gitlab.com/ee/user/packages/container_registry/

and of couse docker themselves have a container for a private registy you can run.

the question is not so much how but where you want it to be and how big the images are that you are using!

Hope this helps otherwise hit me up on linkedin (in my profile) and we can figure something out

Re: Docker is deleting Open Source organisations - what you need to know

#696

Post by unobatbayar »

rodgerd wrote: post #675
Wowfunhappy wrote: post #509

Earlier quoted context omitted.

Unless you're hosting the infrastructure yourself, you can't ever be certain. No one can know for sure what Docker will decide to do in the future. The entire company could shut down tomorrow. But it seems to me that Docker official images are no more at risk of deletion today than they were a week ago.

> Unless you're hosting the infrastructure yourself, you can't ever be certain. I can't be certain I won't be hit by a car, or a storm won't rip up the fibre to my house, or a raft of other things, either.

You relatively can.

Re: Docker is deleting Open Source organisations - what you need to know

#697

Post by bayindirh »

hosh wrote: post #482
rcme wrote: post #425

Earlier quoted context omitted.

Even if they were fully in control, there still would not be a distinction because whoever is controller this decision could change their mind at a later date.

My analysis of this: After Kubernetes became the de-facto container orchestration platform, Docker sold a bunch of their business to Mirantis. They shifted their marketing and positioning from enterprise to developers. From public sources, it sounds like their strategy is doing pretty well. The question then is, does Docker look like they are committed to open-source and the open-source ecosystem? 1. You would think…

From my understanding, Docker is moving to become an open to (proprietary) enterprise packager for closed source, or paid for software development.

- Keep access to big, permissively licensed open source software.

- Charge for higher pulling limits and tools.

- Keep source open, but infra closed, hence converting whole infra to "source available".

- Keep "small open source fish" out of the pond, by charging for what's available on the hub/platform.

As a result, they are kinda becoming "Snap Store" of containers. Premium feel, high fees for higher bar for entry, etc.

At the end of the day, Docker is just a hungry whale chasing money. I can't blame them, but they are not motivated by the value they provide anymore. They are motivated by the money they can make.

Sad, but understandable (to a degree). This makes them very easy to disrupt in free software arena. I'm a paying Docker Pro customer, but I might look somewhere else in the long run.

Re: Docker is deleting Open Source organisations - what you need to know

#699

Post by jjav »

dbingham wrote: post #560
jjav wrote: post #477

Earlier quoted context omitted.

> If those images disappear, we lose the ability to release and that's not acceptable. This shines light on why it is so risky (from both availability and security perspectives) to be dependent on any third party for the build pipeline of a product. I have always insisted that all dependencies must be pulled from a local source even if the ultimate origin is upstream. I am continuously surprised how many groups simpl…

We can't go NIH for everything. If we do that we're back to baremetal in our own datacenters and that's expensive and (comparatively) low velocity. We have to pick and choose our dependencies and take the trade off of risk for velocity. This is the tradeoff we made with the move to cloud. We run our workloads on AWS, GCP or Azure, use DataDog or New Relic for monitoring, use Github or GitLab for repos and pipelines,…

> We can't go NIH for everything. If we do that we're back to baremetal in our own datacenters[...]

It's a bit of a leap from keeping copies of dependencies to building your own datacenter. Even the smallest startup can easily do the former.

> This is the tradeoff we made with the move to cloud.

To clarify, when I say keep local copies I meant copies which are under local control (i.e. control of your organization). They may well still physically be in AWS somewhere. The key is that they can't be modified/deleted by some third party who doesn't report to your organization.

Yes, this assumes AWS is too big to fail, but for the typical startup whose entire existence is already dependent on their AWS account being available, this would not increase risk beyond what it already is. Whereas each additional hard dependency on third-party repos do increase risk.

Re: Docker is deleting Open Source organisations - what you need to know

#700

Post by dijit »

aembleton wrote: post #258
dijit wrote: post #231

Earlier quoted context omitted.

What happened to the old mirror lists? The ones where apt/rpm package repositories tend to be hosted?

https://www.debian.org/mirror/list

I mean, why can't (or don't) we use those for things like docker images, npm registries and the like.

All this centralised dependence talk is frustrating (it's expensive, no free lunch etc;) when it's largely been a solved problem for decades.

Post reply on HN